Kibana version:
main
Describe the bug:
No case created because of
[ERROR][plugins.actions] Action 'system-connector-.cases' failed: an error occurred while running the action: Failed to bulk create cases: Error: The length of the title is too long. The maximum length is 160.
[ERROR][plugins.taskManager] Task actions:.cases "657e6690-0648-47e0-bc00-5b1fe4e87577" failed: Error: an error occurred while running the action
Steps to reproduce:
- Create a rule with a very long name
- Add case action and use
kibana.alert.rule.name as group by alert field
- Trigger an alert
Note It also has been triggered using kibana.alerts.case_ids as group by fields. I guess it just needs enough case_ids in the array
Expected behavior:
It should create a case
Any additional context:
We have a guardrail function that doesn't seem to be working as expected. It seems to be trimming the rule name and then adds "... - Grouping by [the rule name]" to it which makes the initial trimming pointless. Without having dug to much into the issue it seems like we should check the end result doesn't exceed the max length too.
Rule name used by me to test this
Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule
Kibana version:
main
Describe the bug:
No case created because of
Steps to reproduce:
kibana.alert.rule.nameasgroup by alert fieldNote It also has been triggered using
kibana.alerts.case_idsas group by fields. I guess it just needs enough case_ids in the arrayExpected behavior:
It should create a case
Any additional context:
We have a guardrail function that doesn't seem to be working as expected. It seems to be trimming the rule name and then adds "... - Grouping by [the rule name]" to it which makes the initial trimming pointless. Without having dug to much into the issue it seems like we should check the end result doesn't exceed the max length too.
Rule name used by me to test this